标签：#mcp

An AI agent can turn one user request into a small storm of model calls, MCP tool calls, retries, partial failures, and background work. If you only meter the final response, you are guessing. If you meter every low-level event without context, you create noise customers will not trust. That is the billing trap many AI product builders are walking into: the product feels simple, but the usage behind it is multi-step, non-deterministic, and easy to dispute. MCP makes this more urgent. The Model Context Protocol gives agents a standard way to call tools, but a standard tool call is not the same thing as a fair usage meter. A production meter needs to answer harder questions: Which customer, workspace, user, and agent run caused the call? Was it read-only or write-capable? Was the call retried, duplicated, cached, rejected, or actually executed? Did it hit a paid upstream API? Should it count toward quota, invoice, abuse limits, or only observability? Can you explain the charge without exposing private prompt or customer data? This guide shows a practical MCP usage metering architecture for solo developers, micro product teams, and AI platform builders who need cost control without surprising users. Why MCP Usage Metering Is Different From Token Tracking Token tracking is mostly linear. You send a prompt, receive a response, and record input tokens, output tokens, model, latency, and cost. Agent tool usage is messier. A single request like "research these accounts and update the CRM" might trigger: A retrieval call to fetch customer rules A search tool call for each account A browser or enrichment call for missing fields A CRM read A CRM write proposal A human approval pause A final write call A summary response Some calls are internal. Some are customer-visible. Some are expensive. Some are dangerous. Some are free but should be rate limited. Some fail after doing real work. Some are retried by the agent, the SDK, the queue, or the network layer. If you charge blindly

Originally published at tengli.dev When I added an LLM-powered eval to mcpgrade , the first real run produced a result that looked like a scoop: context7 — a server with a perfect static score — failed tool selection 62% of the time. A model shown its two-tool catalog picked the "wrong" tool on 5 of 8 tasks. If I had shipped that number, it would have been wrong. Not slightly wrong — systematically, unfairly wrong. This post is about how I caught it, because the failure mode generalizes to most agent benchmarks people are building right now. The setup mcpgrade's --eval mode works like this: it reads a server's tool catalog, synthesizes realistic single-step tasks ("find the Slack channel where the incident was discussed"), shows a model the full catalog, and measures three things — does it pick the right tool, does it fill valid arguments, and does it correctly refuse tasks that no tool can handle. Round 1, on three real servers, cost about twelve cents and produced this: Server Static score Tool selection Args Refusal context7 (2 tools) 100 38% 100% 100% server-memory (9 tools) 81 93% 100% 100% server-slack (8 tools) 97 54% 100% 100% Two servers with excellent static scores, apparently failing live. Either static analysis was worthless, or the eval was broken. The eval was broken Every "miss" traced to one cause. Slack's post_message needs a thread_ts — a value you can only get from a previous call to get_channel_history . context7's get-library-docs needs a library ID that comes from resolve-library-id . These are pipelined tools : their required arguments are produced by other tools. My task synthesizer didn't know that. It generated tasks like "reply to the thread about the outage" — without a thread timestamp. The model, quite sensibly, picked get_channel_history first (to find the thread), or declined. My grader marked both choices wrong. The model wasn't confused. The model was right . The benchmark was grading correct multi-step reasoning as failure — and me

This is the architecture of Shibui Finance , an MCP server that gives Claude direct SQL access to 64 years of US stock market data. About 10,000 symbols, 31 million daily price records, quarterly financials back to 1990, 56 pre-computed technical indicators, and 6.4 million SEC filing records. Free to use. Stack: Python, PostgreSQL, dbt, DuckDB, FastMCP, Caddy. Runs on a single VPS. Data pipeline Three stages: ingest into PostgreSQL, transform with dbt, export to DuckDB. Data APIs / SEC EDGAR / FRED | Python ETL (Polars, ADBC) | PostgreSQL clean_* schemas (~50 raw tables) | dbt (27 models) staging -> integration schema (17 analytical tables) | DuckDB export (daily, ~14 GB file) | FastMCP server (read-only, streamable-http) | Caddy (TLS) -> mcp.shibui.finance Multiple sources feed the pipeline: commercial data APIs for prices, fundamentals, valuations, and estimates. SEC EDGAR for filing metadata and insider transactions (bulk historical + a 5-minute Atom feed for near-real-time). FRED for FX rates to normalize non-USD fundamentals. Public registries for ticker classification. The ETL is a Python CLI organized by data source. Each module has its own fetcher, loader, and CLI. A single all command runs everything in fixed sequence. You can't refresh 10,000 tickers daily without hitting rate limits, so the ETL rotates: each run refreshes the stalest 5% of tickers. Full universe cycles in about 20 runs. Recent prices always refresh on every run. Every table write is a single transaction. DROP + CREATE inside a transaction, rollback on failure. The database never serves partial data, and dbt always sees complete tables even when ingest jobs overlap. The dbt layer 27 models in two tiers. The process layer handles standardization: enriching symbols with security types and exchange mappings, linking SEC amendment filings to their originals, repairing filer date typos. The integration layer produces the 17 tables that Claude actually queries. This is where raw normalized tabl

Container-Native AI: Mastering GPU Passthrough, Memory Limits, and Auto-Scaling for Your Agent Infrastructure Unlock peak performance for your AI agents by mastering container resource management. This guide details Docker AI configurations for GPU passthrough, precise memory limits, and dynamic auto-scaling of containerized agents to build robust, cost-efficient AI infrastructure. The Container Imperative for AI Workloads The promise of AI agents—autonomous systems that reason, plan, and execute—hinges on reliable, scalable infrastructure. Deploying these agents on traditional VMs or bare metal creates inefficiencies: dependency conflicts, inconsistent environments, and manual resource provisioning that can't keep pace with demand. Container AI solves this by packaging agent code, models, and dependencies into immutable images, ensuring perfect reproducibility from a developer's laptop to production. However, containerizing AI isn't as simple as `docker run`. High-performance agents require specialized hardware access, particularly GPUs for model inference. They also demand strict resource boundaries to prevent one agent from starving others and efficient scaling to handle variable workloads. This is where container-native AI infrastructure moves beyond basic virtualization. By leveraging Docker's advanced features and orchestration platforms like Kubernetes, you can build a production-grade environment where GPU access is seamless, resource usage is optimized, and your fleet of containerized agents scales automatically. GPU Passthrough: Unleashing Accelerator Performance in Docker The single greatest performance hurdle for containerized AI is granting direct access to the host's GPU. NVIDIA's Container Toolkit is the standard solution, providing the necessary drivers and runtime hooks. Proper configuration allows a container to see and use the GPU with near-native performance, critical for low-latency inference. The setup begins at the host level, where you instal

This year I've built more MCP servers than I meant to, across three pretty different shapes: vellum : a self-hosted server over a folder of markdown, so my agent has a memory that's just files I own. (Open source, MIT.) Metrifyr : a marketing-data server that puts GA4, Search Console, AdSense and Tag Manager behind one connection. A read-only gateway over a company's internal user-data stack, federating half a dozen internal services behind one audited MCP surface. Personal, product, enterprise. Totally different data, totally different stakes. And yet the things that made each one good , versus a flashy demo that falls over the moment a real agent uses it in anger, were the same every time. Here are the seven that keep recurring. 1. Every tool you expose is a tax on the agent's context This is the one nobody warns you about. Every tool definition (name, description, JSON schema) gets loaded into the model's context on every single request , whether or not it's ever called. Twenty tools of boilerplate and the agent is reading pages of plumbing before it touches your data. So the design pressure runs the opposite way from a normal API: fewer, broader tools beat many narrow ones. vellum has 15 core tools and I fought to keep it there. If a tool doesn't earn its slot in the context window on most requests, it shouldn't be a tool. 2. Tools are for acting. Resources are for reading. The corollary to #1. Most servers expose everything (including "read this thing") as a tool. But MCP has a better primitive for reading: resources . In vellum, every note is a resource at a stable URI ( vellum://note/projects/x.md ). The agent attaches a document by reference instead of spending a tool round-trip to fetch it, and it can subscribe to that URI and get told the moment the note changes. Reading through a resource costs no tool definition. Reading through a tool costs one on every request. Use the right primitive. 3. Fail closed on auth, fail open on limits A token with no grants

I read a post this week where someone connected three MCP servers to one agent and watched it casually request the same access it'd need to hit production. The comment thread was full of "yeah, that's the whole problem with MCP" takes, and I almost scrolled past it — I don't run three servers, I run one. Then I actually opened server.py to check, and realized my one server has the exact same shape of problem, just folded into a single file instead of spread across three. server.py is a FastMCP server with 8 tools split across two unrelated jobs: GitHub profile/repo reads, and DEV.to article reads and writes. Both credentials get loaded the same way, at import time, into the same process environment: def load_env ( path = " .env " ): try : with open ( path ) as f : for line in f : line = line . strip () if line and not line . startswith ( " # " ) and " = " in line : k , v = line . split ( " = " , 1 ) os . environ . setdefault ( k , v ) except FileNotFoundError : pass load_env () and two helper functions read them back out: def _gh ( path , method = " GET " , data = None ): req = urllib . request . Request ( f " https://api.github.com { path } " , method = method ) req . add_header ( " Authorization " , f " token { os . environ [ ' GITHUB_TOKEN ' ] } " ) ... def _dev ( path , method = " GET " , data = None ): req = urllib . request . Request ( f " https://dev.to/api { path } " , method = method ) req . add_header ( " api-key " , os . environ [ " DEV_TO_API " ]) ... Nothing here is a bug in the sense of "wrong output for some input." Every tool does exactly what it says: get_github_profile reads GitHub, create_article writes to DEV.to. The problem is one level up, in what the process boundary actually protects. I'd been thinking of GITHUB_TOKEN and DEV_TO_API as belonging to different tools , scoped by which function reads them. They don't. They belong to the process . Every one of those 8 tools runs with both credentials sitting in its environment, whether the tool ne

Every tool in the East Africa coordination infrastructure stack started from the same scaffold. Here's exactly how to build and publish one yourself. What You're Building An MCP server is a Python package that exposes tools to AI assistants. When a user installs it and connects it to Claude, the AI can call your tools as naturally as answering a question. pip install your-mcp-server # Then Claude can: # "Check NHIF coverage for outpatient surgery" → calls your tool → returns structured result Step 1: Set Up the Project (2 min) your-mcp-server/ ├── src/ │ └── your_package/ │ ├── __init__.py │ └── main.py ├── pyproject.toml ├── README.md └── .github/ └── workflows/ └── publish.yml mkdir your-mcp-server && cd your-mcp-server mkdir -p src/your_package touch src/your_package/__init__.py src/your_package/main.py Step 2: Write Your Tool (10 min) # src/your_package/main.py from __future__ import annotations from typing import Annotated from fastmcp import FastMCP mcp = FastMCP ( name = " your-mcp-server " , instructions = " Describe what your server does in one paragraph. " , ) @mcp.tool ( description = ( " What this tool does in plain language. " " Include the Western parallel if applicable. " " Note if it uses DEMO data. " ) ) def your_tool ( param1 : Annotated [ str , " Description of param1 " ], param2 : Annotated [ int , " Description of param2 " ] = 0 , ) -> dict : # Your logic here return { " result " : f " Processed { param1 } " , " note " : " DEMO — replace with real data source in production " , " source " : " your-mcp-server " , } def main (): mcp . run () if __name__ == " __main__ " : main () Step 3: Configure pyproject.toml (3 min) [build-system] requires = ["setuptools> = 61.0 "] build-backend = "setuptools.build_meta" # ← exact string, no variation [project] name = "your-mcp-server" version = "0.1.0" description = "One-line description" authors = [{name = "Your Name" , email = "you@example.com" }] license = { text = "MIT" } readme = "README.md" requires-pytho

I gave Claude one prompt. Claude wrote a web page and published it. The page is live at a permanent URL. I did not open a dashboard. I did not run a build. This article shows the full procedure. You can complete it in less than five minutes. Disclosure: I run Nippy , the hosting service in this article. What makes this possible MCP (Model Context Protocol) is an open standard. It lets an AI assistant call external tools. A tool can read data. A tool can also do work in the real world. Nippy is a static hosting service. You give it files. It gives you a live URL that does not expire. Nippy has an MCP server. When you connect it, Claude gets one new ability: it can publish websites. The result is a very short path from an idea to a live page: prompt → Claude writes the files → one tool call → live URL Set up the connector There are two paths. Use the one that matches your setup. Path A: claude.ai in the browser Open claude.ai. Go to Settings → Connectors . Add Nippy as a connector. Approve the connection. Path B: Claude Desktop, Claude Code or Cursor Run the MCP server with one command: npx nippy-mcp Add it to your client configuration. For Claude Desktop, the entry looks like this: { "mcpServers" : { "nippy" : { "command" : "npx" , "args" : [ "nippy-mcp" ] } } } Restart the client. The Nippy tools are now available. The Nippy help center has a full guide for each client. Publish a page Give Claude a prompt. This is the prompt I used: Make a small demo page and publish it with Nippy. Claude then does three things: Claude writes the HTML file. Claude calls the Nippy MCP server with the file. Nippy returns a live URL. The tool call is simple. This is its shape: { "name" : "published-by-claude" , "files" : [ { "path" : "index.html" , "content" : "<!DOCTYPE html>..." } ] } The response came back in a few seconds: { "url" : "https://published-by-claude.nippy.site" , "status" : "live" , "note" : "Live now. The link does not expire." } That page is real. Claude published it

Model Context Protocol servers have quickly become the connective tissue between AI agents and the outside world — file systems, databases, APIs, internal tools, you name it. That convenience comes with a catch: the tools, prompts, and schemas an MCP server exposes are a new kind of attack surface, and most traditional scanners simply don't look there. MCPRadar is an open-source project built specifically to close that gap. Why this matters A recent academic study examining nearly 1,900 MCP servers found meaningful security issues in a surprising share of them — general vulnerabilities in roughly 7% and MCP-specific tool poisoning in another 5%. Tool poisoning, prompt injection hidden in tool descriptions, and quietly over-permissioned configurations are easy to miss because they don't look like a "normal" vulnerability — there's no CVE, no obvious buffer overflow, just a tool description that quietly tells an agent to do something it shouldn't. MCPRadar's whole premise is that this class of risk deserves the same rigor as any other part of your CI pipeline. What it actually scans MCPRadar isn't a single-purpose linter — it looks at an MCP server from several angles: Protocol inspection — enumerates tools, prompts, resources, and templates the server exposes, and checks server instructions for suspicious content. Source analysis — walks Python and JavaScript/TypeScript code looking for SSRF, unsafe deserialization, command/SQL injection, Trojan Source tricks, and mismatches between a tool's description and what its code actually does. Configuration review — flags poisoned MCP or agent configuration files, risky hooks, and overly broad permission grants. Supply chain checks — fetches packages without running install scripts, cross-references dependencies against OSV, and can emit a CycloneDX SBOM with hashes and provenance. Change monitoring — stores snapshots in SQLite and diffs them over time, classifying changes as cosmetic, behavioral, or security-relevant so sil

Traditional API gateways assume deterministic services and simple schemas - assumptions agentic AI breaks. Discover why enterprise engineering leaders are adopting AI Gateways as an evolutionary architecture seam. Centralize guardrails, model routing, agent identity, action policy, and semantic audit within a single control plane to prevent costly incidents while keeping core platforms stable. By Joe Price, Branimir Đurek, Pavlos Migkiros, Trevor Dearham

Why Your AI Agent Drowns in 50,000 Tokens of Tool Definitions Every time you connect an MCP server to your AI agent, you're adding thousands of tokens of tool definitions to your context window. Connect 10 servers? That's 50,000 tokens of tool schemas before you've even asked a question. Your agent is drowning in tools it doesn't need. The Problem Traditional MCP integration dumps every available tool into the context: { "tools" : [ { "name" : "file_read" , "description" : "Read a file..." }, { "name" : "file_write" , "description" : "Write a file..." }, { "name" : "shell_exec" , "description" : "Execute shell..." }, // ... 500 more tools ] } Your 200K context window is now 25% full of tool definitions. The model gets confused, response quality drops, and you're paying for tokens that add zero value. The Solution: Progressive Tool Routing HyperNexus implements a multi-layered progressive disclosure system: Semantic Search : Local vector embeddings match your prompt against a global MCP directory The Router : Only the top 3 most relevant tool schemas are injected into context Universal Parity : Byte-for-byte identical tool signatures across Claude Code, Cursor, Codex, Gemini CLI, Copilot, and Windsurf // Only inject what's relevant tools := router . FindRelevantTools ( prompt , 3 ) context . AddTools ( tools ) Results 95% reduction in tool-related context usage 3x improvement in tool selection accuracy Zero hallucinations from irrelevant tool noise Try It Yourself HyperNexus is open source and free for personal use: # Install go install github.com/HyperNexusSoft/HyperNexus@latest # Run hypernexus serve # Connect your MCP servers hypernexus mcp add filesystem hypernexus mcp add github Your AI agent will now only see the tools it needs for each request. This article was originally published on hypernexus.site

GitOps for AI Agents: Treating Tool Configs and Memory Like Production Infrastructure Stop managing AI agent configurations as fragile scripts. Adopt GitOps principles for AI, treating your tool configs and memory as version-controlled, auditable infrastructure-as-code. Learn to implement mcp.jsonc, PR-reviewed workflows, and CI validation for reliable, reproducible AI. The Configuration Chaos in Modern AI Agents Today's AI agents are powerful orchestrators, not just chatbots. They connect to dozens of external tools, databases, and APIs via configurations that define their capabilities, permissions, and memory pathways. But this configuration—often scattered across JSON files, environment variables, or proprietary dashboards—becomes a critical vulnerability. A single typo in a tool's endpoint URL or an incorrect memory namespace can cause silent failures, security leaks, or non-reproducible agent behavior across development and production. Consider a common scenario: Your team updates an AI agent's access to a vector database for its long-term memory. The change is made directly in a production dashboard by an engineer. A week later, the agent starts hallucinating corrupted context. Reverting is guesswork because there's no change log, no PR review, and no record of the previous state. This is the classic "configuration drift" problem that plagued traditional infrastructure, and it's now crippling advanced AI systems. The Infrastructure-as-Code Paradigm for AI The solution lies in applying mature DevOps practices to AI management. We must stop treating AI configurations as special snowflakes and start treating them as infrastructure as code . This means storing all defining components—tool endpoints, authentication scopes, memory indexes, and even behavioral guardrails—in a version-controlled repository. The industry-standard format for this is emerging as mcp.jsonc , a JSONC (JSON with Comments) file that defines an agent's Model Context Protocol tools and memory

The most expensive part of running AI-powered customer support isn't the token cost or the infrastructure—it's the maintenance of truth. You deploy a chatbot, it works brilliantly for three days, then your product team pushes a breaking change to your API or shifts your refund policy. Suddenly, that 'intelligent' agent is hallucinating outdated information with extreme confidence. This is where most developers fail: they treat AI support as a static RAG (Retrieance-Augmented Generation) problem when it should be treated as an observability and orchestration problem. I've spent years building systems where the drift between documentation and reality was the primary cause of production incidents. The MCP (Model Context Protocol) changes this trajectory because, for the first time, we have a standardized way to move beyond 'read-only' agents. When I looked at how Aidbase implements its MCP server, I didn't see just another way to query an FAQ. I saw the blueprint for a self-healing support loop. The Shift from Reading to Operating Most people use MCP to give Claude or Cursor access to their codebase or some documentation files. It's useful, but it's passive. You ask a question; the agent finds an answer. With the Aidbase implementation, the capabilities are fundamentally different because they include 'write' operations via tools like add_aidbase_faq_item and add_aidbase_website_knowledge . This shifts the LLM from being a passive librarian to an active Support Engineer. Think about your current workflow. You find a bug, you fix it, you update the PR, and then... you remember you need to go into the Aidbase dashboard (or Zendesk, or Intercom) to manually update the FAQ so the bot doesn't keep telling customers the old way is correct. That manual step is where human error lives. With this MCP server, your workflow looks like this: You finish the PR in Cursor. You point at the new documentation URL or a snippet of code. You tell Claude: "Update our Aidbase knowledge base

Most MCP servers I see in the wild start as a quick script and stay that way — no validation, no structured logging, no tests, and a deploy story that means shipping node_modules around. I got tired of rebuilding the same scaffolding every time a client project needed a Model Context Protocol server, so I open-sourced the template I now start every one from: 🚀 mcp-server-template It's a production-ready TypeScript/Node.js foundation for building MCP servers that connect AI agents like Claude Desktop and Cursor to your tools, data, and workflows. 𝗚𝗲𝘁𝘁𝗶𝗻𝗴 𝘀𝘁𝗮𝗿𝘁𝗲𝗱 𝘁𝗮𝗸𝗲𝘀 𝗳𝗼𝘂𝗿 𝗰𝗼𝗺𝗺𝗮𝗻𝗱𝘀: git clone https://github.com/qmmughal/mcp-server-template.git cd mcp-server-template && npm install cp .env.example .env npm run dev That spins up a working server in watch mode. npm test runs the Vitest suite, npm run build bundles everything into a single dist/index.js with esbuild — no node_modules to deploy. 𝗪𝗵𝗮𝘁 𝗮 𝘁𝗼𝗼𝗹 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗹𝗼𝗼𝗸𝘀 𝗹𝗶𝗸𝗲: Every tool gets a Zod schema, a definition, and a handler — so a malformed AI payload gets rejected with a clean error instead of crashing your process: const schema = z . object ({ text : z . string (). describe ( " The text to process " ), repeat : z . number (). int (). min ( 1 ). max ( 10 ). optional () }); export async function handleExampleTool ( args : unknown , service : ExampleService ) { return withErrorHandling ( " process_text " , async () => { const { text , repeat } = validateArgs ( schema , args ); const result = await service . processText ( text , repeat ); return { content : [{ type : " text " , text : result }] }; }); } 𝗘𝘅𝘁𝗲𝗻𝗱𝗶𝗻𝗴 𝗶𝘁 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗼𝘄𝗻 𝘁𝗼𝗼𝗹𝘀: Drop a new file in src/tools/ following the same schema → definition → handler shape Register it in src/tools/index.ts — add your definition to the tools list and a case to the switch statement that routes CallToolRequest to your handler Put your real logic in src/services/ so the protocol layer stays thin and your business logic stays unit-testable in isolation Resources (data the

When Your AI Code Reviewers Disagree: Inside the 'AI Debate' That Finds Hidden Bugs Discover how a new paradigm of code review automation pits two AI agents against each other in a structured AI debate, using agent consensus to uncover nuanced bugs that single-agent systems miss. See a real example of AI pair review in action. The End of the Single Perspective Code Review Traditional automated code review tools often operate from a single, deterministic rule set. They flag violations of style guides, potential security flaws, or common anti-patterns with a yes/no verdict. But this approach fundamentally misses the nuance of software development: context. Is a seemingly risky pattern actually a carefully considered workaround? Is a deviation from the norm a brilliant optimization or a latent bug? This is where the old paradigm fails, treating code as static text rather than a dynamic system of intent and consequence. Imagine a different approach. Instead of one monolithic AI passing judgment, what if you deployed two specialized AI agents to review the same code change? Their core directive: engage in a rigorous, technical **AI debate**. One agent is programmed to be a strict adherent to best practices and correctness. The other is trained to understand historical code patterns, developer intent, and often-overlooked performance trade-offs. This is the foundation of **AI pair review**, a method that moves beyond simple flagging and into the realm of collaborative analysis. The Scenario: A Performance Bottleneck with a Catch Let's examine a concrete example. A developer submits a change to a data processing pipeline in a Python application. The core function now includes a caching layer to avoid redundant, expensive database calls. The code change looks clean at first glance. def process_user_data(user_ids): # Cache to avoid repeated DB hits for the same ID in a batch user_cache = {} results = [] for uid in user_ids: if uid not in user_cache: # Simulate an expensive D

Three categories of AI agent safety tooling: observability, security guardrails, and compliance evidence. What each does, where each falls short, and the one most teams are missing. Bottom line: tools for keeping AI agents safe fall into three groups. Observability tells you what an agent did after the fact. Security guardrails try to block dangerous actions before they happen. Compliance evidence tools produce a verifiable, defensible record that an agent's actions were allowed. Most teams deploying agents into regulated or high-stakes work need all three, but the one almost nobody has is the third. If you have to prove to a regulator, an auditor, or a customer that your agent behaved, you need evidence, not a dashboard. This is a practitioner comparison, written by the founder of one of the tools below. It names where each category is strong and where it falls short, including our own limits. 1. Observability and evals These tools capture traces of what your agent did and let you evaluate quality. They are essential for debugging and improving agents, and the category is mature and well funded. Strength: deep visibility into agent behavior, prompt and response inspection, eval pipelines. Limit: they tell you what happened, after it happened. An observability trace is not a compliance record and is not tamper-evident. For a regulator, "here is our internal dashboard" is not evidence, because the party being audited controls the logs. 2. Security guardrails These tools try to stop bad actions before they execute: prompt injection filtering, dangerous-command blocking, data-exfiltration prevention. The category consolidated fast in 2025 to 2026, with several acquisitions by major security vendors. Strength: prevention. Reducing the chance an agent does something harmful. Limit, and it is a fundamental one: prompt-injection prevention is an unwinnable arms race. Peer-reviewed 2026 research shows even the best-defended models are bypassed a meaningful fraction of the t

I created Agent-Up , an open-source desktop app and local server for running multiple coding-agent environments on one machine. Worktrees isolate source code, not the runtime The problem is that Git worktrees isolate source code, but they do not isolate the running application. When several agents work on the same monorepo, each one may need its own: application processes, ports, Docker services, logs, runtime state. Without a shared runtime manager, agents end up coordinating those details through shell commands. That is fragile. One agent may reuse a port that another process still owns. A restart may leave an old process alive. Docker services may overlap. Runtime isolation per workspace Agent-Up manages those concerns per workspace. Each workspace gets its own process lifecycle, allocated ports, Docker services, logs, and runtime state. The desktop app also provides one browser session per workspace for reviewing its web applications. Agents control Agent-Up through MCP The current MCP interface supports: starting and stopping workspaces listing registered workspaces reading workspace status The Agent-Up server owns the runtime state behind those operations. That means the agent does not need to independently discover ports, track process IDs, or reconstruct the application topology through shell commands. The missing runtime layer for parallel coding agents This is relevant because current coding agents are increasingly used in parallel. The source-code side of that workflow is already well served by Git branches and worktrees. The runtime side is not. Agent-Up is intended to provide that missing runtime layer. Planned MCP functionality Planned MCP functionality includes: browser inspection and interaction, diagnostics, screenshots, health checks, Playwright flow export. Same workflow, more control Git still owns branches, commits, pull requests, and merges. Agent-Up just owns the local runtime around them. Agent-Up is open source View Agent-Up on GitHub Read t

An MCP server is a small app that extends an AI model's capabilities by giving it access to custom tools, a particular set of data or workflows. It's based on the Model Context Protocol, which is an open standard for connecting AI apps with these external sources. The most straightforward way to create an MCP server is to use the official SDK, implement a single function and mark it as a tool and then expose it through stdio (standard input/output) which you can register in Claude Code; it basically boils down to a single Python file with a single tool and connecting it end-to-end took us around 10 minutes. Background Generally, the Model Context Protocol defines two sides: The server — it's the app you write that you use to publish tools/data The client — for example Claude Code; it finds and calls available tools based on your permission As for the main purpose of the Model Context Protocol — before it was introduced, every AI app needed its own custom integration with every tool; the Model Context Protocol replaces this with a single standard connector, so to say it's like USB-C for the AI world — you have a single standardised port instead of having to use a separate cable with every device. In terms of the protocol, a tool is just a function that the model can decide to call. So if you want to build an MCP server, you do it when you want your model to have access to some resources you have (like your internal API or database for example) which aren't available through any of the already-published servers. Let's have a look at a minimal example of what such server might look like — a single Python file with a single tool that returns the number of words, characters and lines in the input text. Scaffold the project To set up the project we used uv (a CLI for managing Python projects) and installed the official SDK: uv init word-count-mcp cd word-count-mcp uv add "mcp[cli]" uv init word-count-mcp — initialises a new project called "word-count-mcp" with an uv proje

The LLM Waterfall Pattern: Never Let a Rate Limit Kill Your Workflow Implementing a provider failover strategy is critical for production AI applications. Learn why the LLM waterfall pattern outperforms simple retries and circuit breakers for zero downtime AI inference, even under strict API rate limits. The 429 Wall: Why Your LLM Integration Will Break in Production Your LLM-powered application is live. Traffic is growing, and users are loving the AI features. Then, it happens. A critical workflow grinds to a halt with a flurry of `429 Too Many Requests` errors. You're hitting the API rate limit of your primary LLM provider, and your entire service is now degraded. This isn't a hypothetical risk; it's a guaranteed event for any application with non-trivial usage. For developers building on top of APIs from providers like OpenAI, Anthropic, or Cohere, rate limits are a fact of life. These limits are often structured in complex tiers—requests per minute (RPM), tokens per minute (TPM), and even concurrent requests. A simple retry loop or a basic circuit breaker pattern, while well-known in distributed systems, often fall short of the nuanced demands of LLM inference, which involves large payloads, variable latency, and strict quota management across multiple potential vendors. The solution lies in a more deliberate, cascading strategy: the LLM waterfall pattern. Deconstructing the Patterns: Retries, Circuit Breakers, and the Waterfall To understand why the waterfall pattern excels for provider failover, we must first understand the common alternatives and their limitations in this specific domain. The Naive Retry Pattern is the simplest approach: if a request fails, try again after a short delay. For transient network blips, this is useful. For an `API rate limit` error, it's disastrous. Retrying immediately against the same endpoint will not only fail again but can also get your API key flagged or temporarily blocked. Even with exponential backoff, you are stuck in a

Estimated reading time: ~11 minutes. No prior experience required. Fifty adapters in a drawer Remember the era when every phone, camera, and gadget had its own special charger? A drawer full of incompatible cables, and the one you needed was never there. Then USB (and later USB-C) arrived, and suddenly one port charged everything. The magic wasn't a better cable, it was an agreed-upon standard that every device and every charger followed. AI tools were living in that pre-USB drawer. Every time you wanted an AI assistant to talk to a new system, your files, a database, a ticketing tool, someone had to hand-build a custom connector for that specific pairing. Ten AI apps times ten tools meant a hundred bespoke integrations. The Model Context Protocol (MCP) is the USB-C moment for AI: one standard so any AI app can talk to any tool. By the end of this post you'll understand what MCP is, its core parts, how a connection works, the traps to watch, and why it matters for the future of AI. What is MCP, really? One sentence: The Model Context Protocol is an open standard that defines a common way for AI applications to connect to external tools, data sources, and services, so any compliant AI app can use any compliant tool without custom glue. It was introduced to solve the "N times M" integration explosion: instead of building a custom bridge for every AI-app-to-tool pair, everyone speaks one shared language. The USB-C analogy (in full) The AI app (a chat assistant, a coding agent, an IDE) is your laptop . A tool or data source (your files, a database, a calendar, a search engine) is a peripheral , a monitor, a drive, a keyboard. MCP is the USB-C port and cable standard between them. Before USB-C, connecting a new monitor to your laptop might need a special adapter made just for that model. After USB-C, you plug in any compliant monitor and it just works. MCP does that for AI: build your tool as an "MCP server" once, and every MCP-compatible AI app can use it, no per-app wo